2 reports · 2 sources · tracked since 4d ago

"City-Forum" data-theft attacks target Salesforce, ServiceNow portals

AI synthesis A campaign dubbed "City-Forum" uses custom tools to exploit unauthenticated guest access on Salesforce and ServiceNow portals, quietly enumerating and exfiltrating exposed data.

cloud

Why this ranks Transparent score: 12

coverage +6 source breadth +4 urgency +0 freshness +2

What changed

Coverage timeline

Every report remains linked to its original publisher.

SecurityWeek Aug 12, 2026, 1:00 PM UTC First observed

Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset ↗

Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data from both platforms. The post Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset appeared first on SecurityWeek.
BleepingComputer Aug 12, 2026, 11:07 PM UTC Coverage expanded

"City-Forum" data-theft attacks target Salesforce, ServiceNow portals ↗

An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals. [...]

Coverage timeline

Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset ↗

"City-Forum" data-theft attacks target Salesforce, ServiceNow portals ↗